Messages in this thread |  | | Date | Thu, 2 Apr 2026 15:09:56 +0800 | | Subject | Re: [PATCH v3] ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY | | From | Joseph Qi <> |
| |
On 4/2/26 12:17 PM, Andrew Morton wrote: > On Thu, 2 Apr 2026 11:47:12 +0800 Joseph Qi <joseph.qi@linux.alibaba.com> wrote: > >> >> >> On 4/2/26 11:08 AM, tejas bharambe wrote: >>> filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, >>> as documented in mm/filemap.c: >>> >>> "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock >>> may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." >>> >>> When this happens, a concurrent munmap() can call remove_vma() and free >>> the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then >>> becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call >>> dereferences it -- a use-after-free. >>> >>> Fix this by saving the inode reference before calling filemap_fault(), >>> and removing vma from the trace event. The inode remains valid across >>> the lock drop since the file is still open, so the trace can fire in >>> all cases without dereferencing the potentially freed vma. >>> >>> Reported-by: syzbot+a49010a0e8fcdeea075f@syzkaller.appspotmail.com >>> Closes: https://syzkaller.appspot.com/bug?extid=a49010a0e8fcdeea075f >>> Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com> >>> Signed-off-by: Tejas Bharambe <tejas.bharambe@outlook.com> >> >> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> > > Cool. > > I think a cc:stable is needed? > > The code looks like it dates back to 2011, so Fixes: isn't needed. > > > A process thing: as far as I know, the -stable maintainers will > automatically gather any patch which has a Fixes:. But they've been > asked not to do that for MM patches, so there's a risk they'll see an > ocfs2 patch is from my tree and not backport it. I like to add > a cc:stable just to be sure. > > Also, because this one doesn't have a Fixes: it might not be grabbed by > the -stable trees. An explicit cc:stable again removes doubt. > > But that's just my late night waffling which can be ignored. For every > single patch I always consider cc:stable so other people don't have to ;)
Yes, cc stable is preferred here.
Thanks, Joseph
|  |